The number of businesses affected by ransomware has increased fourfold due to AI

“The popularity of cybercrime toolkits such as WormGPT, FraudGPT and BruteForceAI has contributed to this increase,” according to the Global Threat Overview report recently published by FortiGuard Labs, a research unit of cybersecurity company Fortinet (USA).

Specifically, the number of organizations and businesses affected by ransomware attacks in 2025 has increased nearly four times compared to the previous year, mainly in the manufacturing, business services and retail sectors. The time it takes to carry out a serious attack is reduced to 24 to 48 hours, compared to nearly 115 hours previously.

“Cybercriminal groups have leveraged artificial intelligence to carry out more sophisticated attacks,” said Derek Manky, Vice President of FortiGuard Labs.

This is a consequence of cyberattacks being “industrialized” with services such as selling system access rights, selling AI attack tools, and “helping” people who are not too technically skilled to still be able to rent or buy tools to perform attacks.

For example, FortiGuard Labs notes that tools such as WormGPT and FraudGPT help create phishing email and script content, create malicious code, and BruteForceAI supports system login attacks, advertised as services and products on the dark web. Or HexStrikeAI – combining security tools with AI agents to automatically search for weaknesses in the system – is also bought and sold and misused to become an attack tool.

Data from the report shows a 22% decrease in password guessing attacks, but according to FortiGuards Labs, this is a negative signal, demonstrating that new tools help criminals exploit more effectively right from the target selection and data collection stages, increasing the probability of success and reducing the number of attempts.

Cybercriminals are now not only trading lists of leaked passwords but have also turned to full data packages taken from infected devices. These packages, called “stealer logs”, may contain passwords, login cookies, browser data and account-related information. Because there is more data involved, it is easier for bad actors to impersonate users or re-login to systems and services than with just a single password.

According to FortiGuard Labs, the amount of stealer logs taken from systems infected with information theft software in 2025 increased 500% compared to the previous year, and continues to increase by 79% year to date.

In data sold and shared on the dark web, stealer logs account for 67.12%, a proportion that exceeds combined lists or leaked login information (about 5-15%), showing that hackers are turning to more contextual data to attack faster and more effectively.

“As cybercriminals increasingly use AI, security units must develop cyber security operations into an industrialized defense system and apply AI-powered tools capable of responding with the same speed to new threats,” Mr. Manky recommended.